The present invention relates generally to a digital control system for controlling an internal combustion engine, an automotive brake system, an air conditioning system or the like. More particularly, the invention relates to a failure-monitor system for a digital control system, which includes one or more failure-indicators which turn on when the corresponding elements fail and can be reset automatically.
In general, it would make maintenance easier to provide a failure-monitor for a digital control system for the purpose of indicating faulty elements. Various systems for detecting failure of sensors and/or actuators and of course digital controllers per se are known in the prior art. Some such failure detecting systems include failure-monitors for indicating or identifying malfunctioning elements of the control system when the control system fails.
For example, U.S. Pat. No. 4,402,217, issued on Sept. 16, 1983 to Kazuhiro Higashiyama and commonly assigned to the assignee of the present invention, discloses an electronic engine control system with a checking unit for sensors and actuators therein. The disclosed checking unit is adapted to be connected to the digital controller of an engine control system for applying dummy loads to sensors and actuators selectively to check the operation of those elements. The checking unit includes a plurality of operation monitors which can be turned on and off depending upon the operating state of the sensor or actuator upon checking same.
U.S. Pat. No. 4,363,092, issued on Dec. 7, 1982 to Toshimi Abo, et al. and commonly assigned to the assignee of the present invention discloses a malfunction preventing system for a microcomputer detecting failure of a microprocessor and producing an alarm signal and/or reset signal to reset the control signal to its initial state.
In addition, British Patent Application No. 2,044,485, published on Oct. 15, 1980 discloses a test system for a dynamic machine, e.g. an aircraft auxiliary power unit. A control and test system uses sensors to gather information concerning machine operation and provides control signals to actuate the machine. The processor monitors machine operation and shuts the machine down in the event of a serious fault. The cause of shutdown is recorded in a nonvolatile memory. The test system has a passive mode during operation changes which monitors inputs from the sensors and machine operation. Intermittent and continuous malfunctions which do not cause machine shutdown are recorded in the memory. An active test mode is performed when the machine is shut down, checking sensor circuits, machine control elements and the control and protection processor programs. Faults are recorded in the memory and other faults stored in the memory are retrieved and displayed on a display unit for maintenance and repair personnel.
A similar monitor system is also disclosed in the published West German Patent Application No. 32 29 411 which corresponds to the co-pending U.S. patent application Ser. No. 405,426, filed Aug. 5, 1982, which discloses an electronic device with self-monitor for an automotive vehicle. A self-monitor system for an automotive electronic control system such as an engine control system, an electronic anti-skid brake control system or an electronic automatic power transmission control system, is adapted to check each segment of the electronic control system in order to detect faulty segments. To detect faulty segments, the self-monitor system checks inputs and outputs of the electronic control system. The checked data is stored in a memory which is not erased when the power supply is turned off. The self-monitor system is associated with another automotive microprocessor which includes a display unit. The other automotive microprocessor is adapted to display the results of the checking operation of the self-monitor system in response to a display request manually inputted via a manual unit to display identification of the faulty segment and/or the error condition thereof. The monitor can also be associated with a fault indicator, such as an LED, which turns on in response to detection of error in any of the segments.
In such conventional self-monitor systems, the monitor system must be reset manually after maintenance of faulty elements has been completed in order to clear the monitor memory. If the system is inadvertently not reset after maintenance and some other faulty segment or element should arise while driving the vehicle, unnnecessary maintenance operations would be performed due to erroneous indication of the previous malfunction.